Quick introduction
USIT, the IT department at UiO, has this spring worked intensively to prepare for increased security for all UiO's IT users and for UiO. - The good news is that we are now increasing the security of the IT systems at UiO. We are already known for being at the forefront of IT security in the sector, and now we are introducing a new layer in the security processes, namely two-factor authentication. The introduction of two-factor authentication requirements will initially only apply to logging in to Microsoft 365, ie the web-based products from Microsoft, such as Teams and OneDrive, explains project manager Frank Paul Silye.
What is two-factor authentication?
Two-factor authentication is something that most people already use, for example in connection with contact with public offices and banking services. In short, this is a safer way to confirm who you are. Entering a password is no longer sufficient. You must use two factors:
Something you know, ie your password, and something you have, ie your mobile phone.
Other factors such as fingerprints and other objects and tokens can also be used, but at UiO, login with a password has been chosen together with a confirmation code in an app on the mobile.
Schedule for the introduction at UiO
The new solution has been tested on IT staff since March 9, and the rest of the UiO is now on its way. The Faculty of Theology is first out already on April 6, and the other units will implement the solution in turn in the period up to 5 May. The introductory project has created a schedule for the introduction that you can check if you want to know when it's your turn. Remember that this time it only applies to logging in to Microsoft 365, not all IT services or logging in to computers or anything else. Other services will follow, but then you are already used to it.
What will happen?
- The change is that you will also have to use your mobile phone when you log in. It works much like with BankID on mobile, as most people know. We log in, and receive a message on our mobile to confirm the login, says project manager Silye. - But the first time you log in with two-factor authentication, it's a little different. You need to install authentication app on your mobile and pair the app with your Microsoft login. You do this by scanning a QR code with the app on your mobile. We have good guidelines for this. After the first login, you will not notice anything new until after 30 days, when you will be asked to confirm the login when using Teams or another MS365 product. Then the phone beeps and you just press "approve" in the app. You will be asked for such approval every 30 days, or the nearest login after 30 days, he concludes.
An easy way to secure our documents and data
UiO's IT security manager, Espen Gr?ndahl, is the project owner for the introduction of two-factor authentication at UiO. He explains that there are good reasons why you now have to confirm that it is actually you who is trying to log in. - Only passwords are actually not sufficiently secure. When we now introduce two factors, ie password and confirmation from another device, it becomes much more difficult for attackers to get inside. Passwords can be guessed with hacking tools (brute force), or they can be leaked by mistake. Now it will no longer be enough for unauthorized persons to gain access to your and my data, or misuse UiO's IT infrastructure, says Gr?ndahl.
He says that there are four main ways a password can go astray:
- Leakage of passwords from a website,
- Malware on computers where usernames and passwords are picked up,
- Man in the middle attack - where someone picks up a username and password between you and the service you are logging in to, and
- Phishing attacks - when someone tricks you into entering a password in the wrong place (typically via email)
Common to these attack methods is that they can not be used as long as two factors are required for login. If an attacker were to obtain your password using one of these methods, he would not be able to obtain your mobile phone, and then he could not use the password for anything.
The way forward
Grondahl is pleased that we are now well on our way to introducing extra login security. But is it only for the Microsoft 365 login? - No, absolutely not. This is where we start. Before the summer, there will be a two-factor login on first some services with Feide login and then on our e-mail. We try to take it a little later, so that not all the load comes at the same time. We do not expect many people to have problems, but we want most people to start with two-factor authentication before we put it on the e-mail, as it is one of our most important work tools. There is good and thorough information about when and how two-factor authentication is introduced on the other services. - Other universities have introduced two-factor authentication without it leading to many inquiries for support, so then I am sure that we can do it here at UiO as well, the IT security manager concludes.
Do you want to know more?
Two-factor authentication is now an IT service at UiO, so you will find information and guidelines on the IT service pages. To make it easy, the introductory project has created a shortcut to it called uio.no/two-factor. To get the best user experience when you now have to confirm login with an app on your mobile, the introductory project recommends that you read the guide and make the settings recommended there. Then you do not have to confirm with a code, but just need to press "Approve" in the app on your mobile.